Privacy policy
Last updated 2 September 2026 · The plain-language version says the same thing in fewer words.
This policy covers the Bunya iPhone app and the website at mybunya.com.au, both operated by Biliby Pty Ltd, a company registered in New South Wales, Australia (“we”, “us”). We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
The starting point
Bunya is built so that we hold as little as possible. There are no accounts and no sign-up. The sensitive content — plans, budgets, entries, receipts, provider names, participant names, NDIS numbers, dates and amounts, and every document you scan or import — is stored on your device and processed on your device. It is never transmitted to us, and we could not look at it if we wanted to.
What the app does send
Anonymous usage and crash reports. The app sends anonymous signals (via TelemetryDeck, a privacy-focused analytics service that processes data in the European Union) so we can see which features get used, fix what breaks, and improve the app. These signals contain event names and bucketed counts only — never the content of anything you typed, scanned or imported — and they are not linked to your identity. Debug and test builds send nothing.
Purchase state. If you buy Bunya Plus, the purchase is processed by Apple under Apple's privacy policy. The app uses RevenueCat (a purchases service, processing data in the United States) to confirm entitlement — it receives an anonymous app-generated identifier and purchase state, not your name, Apple ID or payment details.
Consistent with the above, the app's App Store privacy label is “Data Not Linked to You” (purchases, usage data and diagnostics) and “Data Used to Track You: No”.
What the website collects
This website sets no cookies and runs no analytics or trackers. If you use the contact form, we receive the name, email address and message you type, and we use them for one thing: replying to you. The message arrives in our mailbox by email; we keep it as long as the conversation needs and then as ordinary business correspondence. Our hosting provider (Vercel, United States) keeps short-lived standard server logs, such as IP addresses, to run and secure the service.
What we never do
- Sell or trade personal information, to anyone, ever.
- Show ads or include advertising SDKs.
- Track you across other apps or websites.
- Use anything you put into Bunya for advertising, profiling, or training machine-learning models.
Storage, security and retention
Your plan data lives in the app's storage on your device, protected by iOS's device encryption. It is retained until you delete it — deleting an entry, a plan, or the app removes it. Because we don't hold a copy, we can't recover it for you; your phone backup is your backup. The small amount of information we do hold (support emails, anonymous analytics) is kept only as long as it is useful.
Access, correction and deletion
For your plan data: it's on your phone, so access, correction, export and deletion are all in your hands, in the app. For anything we hold (in practice, support correspondence): email us and we'll show you what we have, correct it, or delete it. Anonymous analytics can't be connected back to you, which also means we can't retrieve or delete “your” records from it — there is no way to know which are yours.
Overseas disclosure
The processors above are the complete list: Apple (purchases), RevenueCat (purchase state, US), TelemetryDeck (anonymous analytics, EU) and Vercel (website hosting, US). None of them receive the content of your plan.
Complaints and questions
Email hello@biliby.co and a person will reply, usually within one business day. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Changes
If this policy changes in a way that matters, we'll say so here and bump the date at the top. The promise that your plan's content stays on your phone is the foundation of the product, not a setting we'll quietly flip.